tag 50d3e3b98e4d9b07cacb1f80b8a2381ab3befee8
tagger Jacopo Cappellato <jacopo.cappellato@gmail.com> Sun Apr 25 14:45:34 2021 +0200
object 32a310ca143717efc9f6d1167450b3e5a508ee14

Tag release 17.12.07

commit 32a310ca143717efc9f6d1167450b3e5a508ee14
author Jacques Le Roux <jacques.le.roux@les7arts.com> Mon Mar 29 13:13:55 2021 +0200
committer Jacques Le Roux <jacques.le.roux@les7arts.com> Mon Mar 29 13:24:08 2021 +0200
tree 250226b24814abecef0990b7b5f26282201fc744
parent 63df767bee7088605c45eab68882f152fe0b9e27

Improved: Comment out the SOAP and HTTP engines (OFBIZ-12212)

The SOAP and HTTP engines are open doors to security issues.
At https://markmail.org/message/pgtjyh23bazq4s2w I proposed to comment them out
as we did for RMI in the past.
Of cause it must be clearly documented how to use them if needed.

Here is the email content:

    After the recent fix for the CVE-2021-26295[1] we discussed with the security
    team about the opportunity need to comment out the SOAP and HTTP engines
    like we did in the past for RMI[2], this obviously for security reason.

    [1] OFBIZ-12167 "Adds a blacklist (to be
    renamed soon to denylist) in Java serialisation (CVE-2021-26295)"
    [2] OFBIZ-6942 "Comment out RMI related
    code because of the Java deserialization issue [CVE-2016-2170] "

I just put a small comment in webtools and scrumm controllers, it should be
enough.

The tests pass

Conflicts handled by hand
  scrum/servicedef/services.xml